3 ms·

I’m certain AOL had a Mac client in the 1990s, but I’m not sure when the first Mac AIM was released. This exploit wouldn’t work on the Mac version, because Macs

I’m certain AOL had a Mac client in the 1990s, but I’m not sure when the first Mac AIM was released. This exploit wouldn’t work on the Mac version, because Macs at the time were 68000 and PowerPC-based, so it seems quite short-sighted to depend on i386 exploits for client identification.

lproven 5y ago
[Story submitter, FWIW] Oh, they definitely did – I used it myself. I think these shenanigans were mainly to counter 3rd parties from connecting to AIM. MSN tried to very briefly, I think, but AOL attacked GAIM (now called Pidgin) consistently for years. JOOI: the author of the piece is the same person who uncovered Microsoft's AARD code that made Windows 3.1 fake failing on DR-DOS.
- lanstin 5y ago
  Former AOLer here. It was to stop Microsoft. This was the third time Microsoft tried to take out AOL. They tried saying that they were running on MacOS earlier but in that case TCP fingerprinting was added to the Mac client logging path and windows looks different from Mac at the TCP layer. Sequence numbers if I recall. We didn’t feel it was bad to buffer overflow our own code, since it was client code we wrote in the first place. Later client versions had some sort of “checksum this range of virtual memory and return the checksum” and the buffer overflow fixed. As far as GAIM the dev team didn’t care about that, and efforts to stop it were pretty much half hearted, if I recall. We ended up hosting an end point “toc.oscar.aol.com” to let things like the TCL client and the elisp client work. We couldn’t convince people to release the protocol specs for the full Oscar protocol unfortunately.
  - lproven 5y ago
    Fantastic detail! Thanks for that.
userbinator 5y ago
They probably had a way of detecting those clients due to some other differences in their protocol traffic.
bradknowles 5y ago
I worked at AOL in 1995, and I had a Mac. The Mac client was well known by then.

lproven 5y ago

[Story submitter, FWIW] Oh, they definitely did – I used it myself. I think these shenanigans were mainly to counter 3rd parties from connecting to AIM. MSN tried to very briefly, I think, but AOL attacked GAIM (now called Pidgin) consistently for years. JOOI: the author of the piece is the same person who uncovered Microsoft's AARD code that made Windows 3.1 fake failing on DR-DOS.

lanstin 5y ago
Former AOLer here. It was to stop Microsoft. This was the third time Microsoft tried to take out AOL. They tried saying that they were running on MacOS earlier but in that case TCP fingerprinting was added to the Mac client logging path and windows looks different from Mac at the TCP layer. Sequence numbers if I recall. We didn’t feel it was bad to buffer overflow our own code, since it was client code we wrote in the first place. Later client versions had some sort of “checksum this range of virtual memory and return the checksum” and the buffer overflow fixed. As far as GAIM the dev team didn’t care about that, and efforts to stop it were pretty much half hearted, if I recall. We ended up hosting an end point “toc.oscar.aol.com” to let things like the TCL client and the elisp client work. We couldn’t convince people to release the protocol specs for the full Oscar protocol unfortunately.
- lproven 5y ago
  Fantastic detail! Thanks for that.

userbinator 5y ago

They probably had a way of detecting those clients due to some other differences in their protocol traffic.

bradknowles 5y ago

I worked at AOL in 1995, and I had a Mac. The Mac client was well known by then.